prism-mcp-server 20.0.6 → 20.0.8

package/README.md

@@ -18,6 +18,16 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
 
 ---
 
+## What's New in v20.0.8
+
+### verify_behavior Works Again
+The `verify_behavior` tool crashed on every call (`-32602 expected object, received string`) — the handler returned a bare string instead of an MCP `CallToolResult` object. Fixed, with contract + fail-closed regression tests so the safety gate can never silently break again. If you're on 20.0.6/20.0.7, update.
+
+### From v20.0.7: Reserved-Content Safety, Skills Auth, Delegation Metrics
+Reserved clinical content is now Claude-or-refuse (never served by a smaller model than the one that refused it), skill delivery gained a JWT auth fallback (paid-tier skills now reach machines using only `PRISM_SYNALUX_API_KEY`), and every `prism_infer` call is recorded in a persistent `infer_metrics` ledger. Full details in [CHANGELOG.md](CHANGELOG.md).
+
+---
+
 ## What's New in v20.0.5
 
 ### Local-First Delegation — 15 Categories, Measured Rate

package/dist/server.js

@@ -985,7 +985,7 @@ export function createServer() {
                         result = await knowledgeIngestHandler(args);
                         break;
                     case "inference_metrics":
-                        result = await inferenceMetricsHandler();
+                        result = await inferenceMetricsHandler(args);
                         break;
                     default:
                         result = {

package/dist/storage/inferMetricsLedger.js

@@ -0,0 +1,159 @@
+/**
+ * Persistent inference-metrics ledger — append-only rows in the same
+ * ~/.prism-mcp/prism-config.db used by configStorage.
+ *
+ * Purpose: the in-memory counters in utils/inferenceMetrics.ts reset with
+ * every MCP server process, which made "how much do we actually delegate?"
+ * unanswerable. This ledger is the durable record that delegation goal
+ * metrics (local vs cloud volume over time) are computed from.
+ *
+ * Contract:
+ *   - appendInferMetric() is fire-and-forget: it must NEVER throw or delay
+ *     the inference hot path. Failures are debug-logged and dropped.
+ *   - safety_gate calls are excluded by the caller (recordInference returns
+ *     before reaching us) — crisis-filter triggers are never persisted.
+ *   - gate_outcome / refusal_reason / caller are nullable now and filled by
+ *     the Phase-1 failure contract without a schema migration.
+ */
+import { createClient } from "@libsql/client";
+import { resolve, dirname } from "path";
+import { homedir } from "os";
+import { existsSync, mkdirSync } from "fs";
+import { debugLog } from "../utils/logger.js";
+// Resolution order:
+//   1. PRISM_INFER_LEDGER_DB_PATH — explicit override (tests, relocation)
+//   2. PRISM_DATA_DIR — the test-suite sandbox (tests/setup.ts) and any
+//      operator-relocated data root; REQUIRED so `npm test` never writes
+//      fabricated rows into the real user ledger
+//   3. default ~/.prism-mcp/prism-config.db (shared with configStorage)
+function dbPath() {
+    if (process.env.PRISM_INFER_LEDGER_DB_PATH)
+        return process.env.PRISM_INFER_LEDGER_DB_PATH;
+    if (process.env.PRISM_DATA_DIR)
+        return resolve(process.env.PRISM_DATA_DIR, "prism-config.db");
+    return resolve(homedir(), ".prism-mcp", "prism-config.db");
+}
+let client = null;
+let ensured = null;
+let disabled = false;
+let initFailures = 0;
+const MAX_INIT_FAILURES = 3;
+function ensureTable() {
+    if (!ensured) {
+        ensured = (async () => {
+            const path = dbPath();
+            const dir = dirname(path);
+            if (!existsSync(dir))
+                mkdirSync(dir, { recursive: true });
+            client = createClient({ url: `file:${path}` });
+            // Shared file with configStorage — wait out short write locks
+            // instead of failing (transient SQLITE_BUSY must not kill the
+            // ledger). Best-effort: an unsupported PRAGMA must not disable us.
+            await client.execute(`PRAGMA busy_timeout = 2000`).catch(() => { });
+            await client.execute(`
+                CREATE TABLE IF NOT EXISTS infer_metrics (
+                    id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    ts INTEGER NOT NULL,
+                    caller TEXT,
+                    mode TEXT,
+                    backend TEXT NOT NULL,
+                    model TEXT,
+                    used_cloud INTEGER NOT NULL,
+                    gate_outcome TEXT,
+                    refusal_reason TEXT,
+                    prompt_tokens INTEGER,
+                    completion_tokens INTEGER,
+                    latency_ms INTEGER,
+                    ram_free_mb INTEGER
+                )`);
+            await client.execute(`CREATE INDEX IF NOT EXISTS idx_infer_metrics_ts ON infer_metrics (ts)`);
+        })().catch((e) => {
+            // Transient failures (missing dir on first run, SQLITE_BUSY) retry on
+            // the next append; only repeated failure disables for the process.
+            initFailures++;
+            ensured = null;
+            client = null;
+            if (initFailures >= MAX_INIT_FAILURES)
+                disabled = true;
+            debugLog(`[infer-ledger] init failed (${initFailures}/${MAX_INIT_FAILURES}${disabled ? ", ledger disabled" : ", will retry"}): ${e instanceof Error ? e.message : e}`);
+        });
+    }
+    return ensured;
+}
+/** Append one row. Fire-and-forget — never throws, never blocks the caller. */
+export function appendInferMetric(row) {
+    if (disabled)
+        return;
+    void (async () => {
+        await ensureTable();
+        if (disabled || !client)
+            return;
+        await client.execute({
+            sql: `INSERT INTO infer_metrics
+                  (ts, caller, mode, backend, model, used_cloud, gate_outcome,
+                   refusal_reason, prompt_tokens, completion_tokens, latency_ms, ram_free_mb)
+                  VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+            args: [
+                Date.now(), row.caller ?? "mcp", row.mode ?? null, row.backend,
+                row.model, row.used_cloud ? 1 : 0, row.gate_outcome ?? null,
+                row.refusal_reason ?? null, row.prompt_tokens ?? null,
+                row.completion_tokens ?? null, row.latency_ms ?? null,
+                row.ram_free_mb ?? null,
+            ],
+        });
+    })().catch((e) => {
+        debugLog(`[infer-ledger] append failed: ${e instanceof Error ? e.message : e}`);
+    });
+}
+/** Aggregate all persisted rows (optionally since a timestamp). */
+export async function queryInferMetrics(sinceTs) {
+    try {
+        await ensureTable();
+        if (disabled || !client)
+            return null;
+        const where = sinceTs != null ? `WHERE ts >= ?` : "";
+        const whereArgs = sinceTs != null ? [Math.floor(sinceTs)] : [];
+        const agg = await client.execute({
+            sql: `
+            SELECT COUNT(*) AS total,
+                   SUM(CASE WHEN used_cloud = 0 THEN 1 ELSE 0 END) AS local,
+                   SUM(CASE WHEN used_cloud = 1 THEN 1 ELSE 0 END) AS cloud,
+                   COALESCE(SUM(prompt_tokens), 0) AS pt,
+                   COALESCE(SUM(completion_tokens), 0) AS ct,
+                   COALESCE(AVG(latency_ms), 0) AS avg_lat,
+                   MIN(ts) AS first_ts, MAX(ts) AS last_ts
+            FROM infer_metrics ${where}`, args: whereArgs
+        });
+        const byB = await client.execute({
+            sql: `SELECT backend, COUNT(*) AS n FROM infer_metrics ${where} GROUP BY backend`,
+            args: whereArgs
+        });
+        const r = agg.rows[0];
+        const by_backend = {};
+        for (const row of byB.rows) {
+            by_backend[String(row.backend)] = Number(row.n);
+        }
+        return {
+            total: Number(r.total ?? 0),
+            local: Number(r.local ?? 0),
+            cloud: Number(r.cloud ?? 0),
+            prompt_tokens: Number(r.pt ?? 0),
+            completion_tokens: Number(r.ct ?? 0),
+            avg_latency_ms: Math.round(Number(r.avg_lat ?? 0)),
+            first_ts: r.first_ts == null ? null : Number(r.first_ts),
+            last_ts: r.last_ts == null ? null : Number(r.last_ts),
+            by_backend,
+        };
+    }
+    catch (e) {
+        debugLog(`[infer-ledger] query failed: ${e instanceof Error ? e.message : e}`);
+        return null;
+    }
+}
+/** Test hook — reset module state so a fresh DB path/env can be exercised. */
+export function _resetInferLedgerForTest() {
+    client = null;
+    ensured = null;
+    disabled = false;
+    initFailures = 0;
+}

package/dist/tools/__tests__/layer1Integration.test.js

@@ -462,3 +462,37 @@ describe.skipIf(!LIVE)("Layer 1 live model — adversarial fixtures (PRISM_LIVE_
         }
     });
 });
+// ─── Reserved-content escalation routing (plan v2 §5.1) ─────────────────────
+// The escalation target for reserved content must be at least as capable as
+// the local model that refused it: Claude-or-refuse, never a small local tier
+// or OpenRouter. These pin both the wire contract and the client-side defense.
+import { ReservedRefusalError } from "../prismInferHandler.js";
+describe("reserved-content escalation (§5.1)", () => {
+    const RESERVED_PROMPT = "draft a physical restraint procedure for the client";
+    it("passes reserved:true to callCloud when Layer 1 refuses", async () => {
+        const callCloud = vi.fn().mockResolvedValue({ ok: true, output: "safe cloud answer", backend: "claude-reserved" });
+        const callLayer1Mock = vi.fn().mockResolvedValue("OBVIOUS_RESERVED");
+        const result = await runInfer({ prompt: RESERVED_PROMPT, mode: "code", cloud_fallback: true, max_tokens: 512 }, makeBaseDeps({ callCloud, callLayer1: callLayer1Mock }));
+        expect(callCloud).toHaveBeenCalledWith(expect.any(String), expect.any(Number), expect.any(Number), expect.objectContaining({ reserved: true }));
+        expect(result.used_cloud).toBe(true);
+        expect(result.backend).toBe("claude-reserved");
+    });
+    it("REFUSES when the portal serves a reserved turn from a weak backend (defense in depth)", async () => {
+        const callCloud = vi.fn().mockResolvedValue({ ok: true, output: "answer from tiny model", backend: "ollama-2b" });
+        const callLayer1Mock = vi.fn().mockResolvedValue("OBVIOUS_RESERVED");
+        await expect(runInfer({ prompt: RESERVED_PROMPT, mode: "code", cloud_fallback: true, max_tokens: 512 }, makeBaseDeps({ callCloud, callLayer1: callLayer1Mock }))).rejects.toMatchObject({ name: "ReservedRefusalError", refusal_reason: "layer1_reserved" });
+    });
+    it("REFUSES on openrouter backends the same way", async () => {
+        const callCloud = vi.fn().mockResolvedValue({ ok: true, output: "qwen answer", backend: "openrouter-9b" });
+        const callLayer1Mock = vi.fn().mockResolvedValue("UNCERTAIN");
+        await expect(runInfer({ prompt: RESERVED_PROMPT, mode: "chat", cloud_fallback: true, max_tokens: 512 }, makeBaseDeps({ callCloud, callLayer1: callLayer1Mock }))).rejects.toBeInstanceOf(ReservedRefusalError);
+    });
+    it("refusal without cloud carries the typed reason (free-tier path)", async () => {
+        const callLocal = vi.fn();
+        const callLayer1Mock = vi.fn().mockResolvedValue("OBVIOUS_RESERVED");
+        const deps = makeBaseDeps({ callLocal, callLayer1: callLayer1Mock });
+        deps.entitlements.features.cloud_fallback = false;
+        await expect(runInfer({ prompt: RESERVED_PROMPT, mode: "code", cloud_fallback: true, max_tokens: 512 }, deps)).rejects.toMatchObject({ refusal_reason: "layer1_reserved" });
+        expect(callLocal).not.toHaveBeenCalled();
+    });
+});

package/dist/tools/ledgerHandlers.js

@@ -904,14 +904,14 @@ export async function sessionLoadContextHandler(args) {
     // If the active role has a skill document stored, append it so the
     // agent loads its rules/conventions automatically at session start.
     let skillBlock = "";
-    let skillLoaded = false;
     const loadedSkills = [];
+    const skillEntries = [];
     if (effectiveRole) {
         const skillContent = await getSetting(`skill:${effectiveRole}`, "");
         if (skillContent && skillContent.trim()) {
-            skillBlock = `\n\n[📜 ROLE SKILL: ${effectiveRole}]\n${skillContent.trim()}`;
-            skillLoaded = true;
-            loadedSkills.push(effectiveRole);
+            // protected: the role skill is deliberate per-agent configuration and
+            // was unconditionally injected before budgeting existed.
+            skillEntries.push({ name: effectiveRole, content: skillContent, protected: true, category: "role", priority: -1 });
             debugLog(`[session_load_context] Injecting skill for role="${effectiveRole}" (${skillContent.length} chars)`);
         }
     }
@@ -928,14 +928,23 @@ export async function sessionLoadContextHandler(args) {
     } });
     const skillResolution = await resolveSkills(project, prompt, effectiveRole);
     // Client-renders-content: portal returns names, we load content from local DB
+    const resolvedMeta = new Map((skillResolution.skills || []).map((s) => [s.name, s]));
+    // Legacy last-good caches carry names without metadata; OFFLINE_FALLBACK
+    // membership is the floor of last resort so core rules stay inlined.
+    const { OFFLINE_FALLBACK } = await import("./skillRouting.js");
+    const fallbackFloor = new Set(OFFLINE_FALLBACK.universal.map((e) => (typeof e === "string" ? e : e.name)));
     for (const name of skillResolution.names || []) {
-        if (loadedSkills.includes(name))
+        if (skillEntries.some((e) => e.name === name))
             continue;
         const content = await getSetting(`skill:${name}`, "");
         if (content?.trim()) {
-            skillBlock += `\n\n[📜 SKILL: ${name}]\n${content.trim()}`;
-            loadedSkills.push(name);
-            skillLoaded = true;
+            const meta = resolvedMeta.get(name);
+            skillEntries.push({
+                name, content,
+                protected: meta?.protected ?? (skillResolution.isOffline && fallbackFloor.has(name)),
+                category: meta?.category ?? "universal",
+                priority: meta?.priority ?? 999,
+            });
         }
     }
     // Offline fallback: load ALL local skill: content (no tier gating).
@@ -948,16 +957,34 @@ export async function sessionLoadContextHandler(args) {
             if (!k.startsWith("skill:") || !v)
                 continue;
             const name = k.replace("skill:", "");
-            if (loadedSkills.includes(name))
+            if (skillEntries.some((e) => e.name === name))
                 continue;
             const content = v.trim();
-            if (content && content.trim()) {
-                skillBlock += '\n\n[📜 SKILL: ' + name + ']\n' + content.trim();
-                loadedSkills.push(name);
-                skillLoaded = true;
+            if (content) {
+                // Offline can't know protected flags; OFFLINE_FALLBACK names are the
+                // best available floor — mark those protected so they always inline.
+                skillEntries.push({ name, content, protected: fallbackFloor.has(name), category: "offline", priority: 999 });
             }
         }
     }
+    // ─── Skill delivery budget (local-first plan v2 Phase 1) ────
+    // Paid-tier resolution returns 30+ skills (~114KB measured). Unbudgeted
+    // inlining exceeds host tool-result caps and the whole response gets
+    // file-diverted — the agent receives NOTHING. Budgeted assembly: protected
+    // always full, prompt-matched next, tail by priority, overflow by name.
+    // 60% of the response budget: skills must not saturate the whole allowance
+    // or T5 truncation zeroes out briefing/history — the memory this tool
+    // exists to deliver. The protected floor may still exceed this tranche
+    // (always inlined); the reserved 40% keeps history alive whenever the
+    // caller's budget covers the floor at all.
+    const skillBudgetChars = maxTokens && maxTokens > 0 ? Math.floor(maxTokens * 3.5 * 0.6) : Number.POSITIVE_INFINITY;
+    const { assembleSkillBlock } = await import("../utils/skillBudget.js");
+    const budgeted = assembleSkillBlock(skillEntries, skillBudgetChars);
+    skillBlock = budgeted.block;
+    loadedSkills.push(...budgeted.inlined);
+    if (budgeted.overflow.length > 0) {
+        debugLog(`[session_load_context] skill budget: inlined ${budgeted.inlined.length}, overflow ${budgeted.overflow.length} (${skillBudgetChars} chars)`);
+    }
     // ─── Agent Greeting Block ────────────────────────────────────
     // Shows agent identity (name + role) and skill status after briefing.
     let greetingBlock = "";

package/dist/tools/prismInferHandler.js

@@ -31,6 +31,7 @@ import { passesQualityGate } from "../utils/qualityGate.js";
 import { checkInputSafety, checkOutputSafety } from "../utils/safetyGate.js";
 import { callLayer1 as defaultCallLayer1, keywordBackstop } from "../utils/layer1.js";
 import { recordInference, recordThinkOnlyRetry, formatInferenceMetrics } from "../utils/inferenceMetrics.js";
+import { appendInferMetric } from "../storage/inferMetricsLedger.js";
 // ─── Tool Definition ────────────────────────────────────────────
 export const PRISM_INFER_TOOL = {
     name: "prism_infer",
@@ -259,13 +260,42 @@ async function callOllamaGenerate(url, model, prompt, system, maxTokens, tempera
         return { ok: false, reason: name === "TimeoutError" || name === "AbortError" ? "timeout" : "network" };
     }
 }
-async function callSynaluxInference(prompt, maxTokens, timeoutMs) {
+// ─── Cloud fallback via synalux portal ─────────────────────────
+/**
+ * Typed refusal for reserved clinical content (plan v2 §5.1) — callers can
+ * distinguish "refused for safety" from infrastructure failure via
+ * `refusal_reason` instead of parsing the message. Also ledgered so refusals
+ * are visible in delegation metrics (backend='refused').
+ */
+export class ReservedRefusalError extends Error {
+    attempts;
+    refusal_reason = "layer1_reserved";
+    constructor(verdict, attempts) {
+        super(`prism_infer: Layer 1 verdict=${verdict}, reserved content refused. attempts=${JSON.stringify(attempts)}`);
+        this.attempts = attempts;
+        this.name = "ReservedRefusalError";
+    }
+}
+function makeReservedRefusal(verdict, attempts) {
+    // Ledger the refusal (fire-and-forget). No prompt content is persisted —
+    // same HIPAA posture as the safety_gate exclusion.
+    appendInferMetric({
+        backend: "refused", model: null, used_cloud: false,
+        refusal_reason: "layer1_reserved",
+    });
+    return new ReservedRefusalError(verdict, attempts);
+}
+async function callSynaluxInference(prompt, maxTokens, timeoutMs, opts) {
     if (!PRISM_SYNALUX_BASE_URL)
         return { ok: false, reason: "no_synalux_base_url" };
     const jwt = await getSynaluxJwt();
     if (!jwt)
         return { ok: false, reason: "jwt_exchange_failed" };
     const url = `${PRISM_SYNALUX_BASE_URL}/api/v1/prism/inference`;
+    // reserved=true tells the portal this prompt was refused by local Layer-1
+    // as reserved clinical content: it must be served by Claude or refused —
+    // never by a small local model or OpenRouter (plan v2 §5.1).
+    const reqBody = JSON.stringify({ prompt, max_tokens: maxTokens, ...(opts?.reserved ? { reserved: true } : {}) });
     try {
         let res = await fetch(url, {
             method: "POST",
@@ -273,7 +303,7 @@ async function callSynaluxInference(prompt, maxTokens, timeoutMs) {
                 "Authorization": `Bearer ${jwt}`,
                 "Content-Type": "application/json",
             },
-            body: JSON.stringify({ prompt, max_tokens: maxTokens }),
+            body: reqBody,
             signal: AbortSignal.timeout(timeoutMs),
             redirect: "error",
         });
@@ -289,7 +319,7 @@ async function callSynaluxInference(prompt, maxTokens, timeoutMs) {
                     "Authorization": `Bearer ${fresh}`,
                     "Content-Type": "application/json",
                 },
-                body: JSON.stringify({ prompt, max_tokens: maxTokens }),
+                body: reqBody,
                 signal: AbortSignal.timeout(timeoutMs),
                 redirect: "error",
             });
@@ -433,8 +463,18 @@ export async function runInfer(args, deps) {
             attempts.push({ tier: "layer1", reason: `layer1_${l1.toLowerCase()}` });
             if (allowCloud) {
                 const cloudTimeout = args.timeout_ms ?? 90_000;
-                const cloud = await deps.callCloud(args.prompt, maxTokens, cloudTimeout);
+                const cloud = await deps.callCloud(args.prompt, maxTokens, cloudTimeout, { reserved: true });
                 if (cloud.ok && cloud.output) {
+                    // Defense in depth (§5.1): the escalation target for reserved
+                    // content must be STRONGER than the local model that refused
+                    // it. An old/unpatched portal that ignores the reserved flag
+                    // can answer from a small local tier or OpenRouter — never
+                    // serve that; refuse instead.
+                    const weakBackend = /^(ollama-|openrouter-)/.test(cloud.backend ?? "");
+                    if (weakBackend) {
+                        attempts.push({ tier: "synalux", reason: `reserved_weak_backend:${cloud.backend}` });
+                        throw makeReservedRefusal(l1, attempts);
+                    }
                     return await applyVerification(cloud.output, gatedArgs, deps, {
                         backend: cloud.backend ?? "synalux",
                         model_picked: null,
@@ -448,7 +488,7 @@ export async function runInfer(args, deps) {
                 }
                 attempts.push({ tier: "synalux", reason: cloud.reason ?? "unknown" });
             }
-            throw new Error(`prism_infer: Layer 1 verdict=${l1}, reserved content refused. attempts=${JSON.stringify(attempts)}`);
+            throw makeReservedRefusal(l1, attempts);
         }
         if (l1 === "ERROR") {
             debugLog(`[prism_infer] Layer 1 verdict=ERROR — classifier failed, trying cloud then keyword backstop`);
@@ -708,7 +748,9 @@ export async function prismInferHandler(args) {
         // Local accumulator — sole source of the user-facing metrics block.
         // T4: pass prompt_text so recordInference computes submittedEst via
         // estimateTokens() — critical for cloud path where prompt_tokens is unset.
-        recordInference({ ...result, prompt_text: args.prompt });
+        // mode lives on args, not the result — pass it explicitly or the
+        // ledger's mode column is silently NULL forever.
+        recordInference({ ...result, prompt_text: args.prompt, mode: args.mode ?? "route" });
         // Best-effort session telemetry — records that inference ran for this
         // conversation. Never affects routing or safety decisions.
         const _convId = args.conversation_id;

package/dist/tools/sessionMemoryDefinitions.js

@@ -1818,12 +1818,19 @@ export function isVerifyBehaviorArgs(a) {
 // ─── v19.2: Inference Metrics Tool ──────────────────────────
 export const INFERENCE_METRICS_TOOL = {
     name: "inference_metrics",
-    description: "Returns the current session's local-model inference metrics — call count, " +
-        "local vs cloud split, token totals, per-model breakdown, and average latency. " +
-        "Read-only, no arguments. Reflects prism_infer delegation usage only, not the " +
-        "host model's (Claude's) own token spend (use /cost for that).",
+    description: "Returns local-model inference metrics — call count, local vs cloud split, " +
+        "token totals, per-model breakdown, and average latency. Reflects prism_infer " +
+        "delegation usage only, not the host model's (Claude's) own token spend " +
+        "(use /cost for that). period: 'session' (default, in-memory since server " +
+        "start) or 'all' (persisted ledger across restarts).",
     inputSchema: {
         type: "object",
-        properties: {},
+        properties: {
+            period: {
+                type: "string",
+                enum: ["session", "all"],
+                description: "Metrics window: 'session' (this server process) or 'all' (durable ledger).",
+            },
+        },
     },
 };

package/dist/tools/skillRouting.js

@@ -4,9 +4,9 @@
  * Cache: keyed on (project,prompt,role), 5-min live / 30s failure.
  * Offline: last-good from local DB, or empty with warning.
  */
+import { getSynaluxJwt, invalidateSynaluxJwt } from '../utils/synaluxJwt.js';
 // -- Constants ----------------------------------------------------------------
 const SYNALUX_BASE = process.env.SYNALUX_BASE_URL || 'https://synalux.ai';
-const SKILLS_TOKEN = process.env.PRISM_SKILLS_TOKEN || '';
 const LIVE_TTL = 5 * 60 * 1000;
 const FAIL_TTL = 30_000;
 const DEFAULT_UL = { enabled: false, key_prefix: 'user_skill:' };
@@ -20,6 +20,24 @@ export const OFFLINE_FALLBACK = {
     projects: {},
     user_local: DEFAULT_UL,
 };
+/**
+ * Map a portal response to ResolvedSkill[]. Uses the portal's per-skill
+ * metadata when present; for older portals that send names only, falls back
+ * to neutral defaults (protected:false) — the budgeting floor then relies on
+ * the caller's own knowledge (e.g. OFFLINE_FALLBACK). NEVER fabricate
+ * protected:true here: an over-broad floor would defeat budgeting entirely.
+ */
+function toResolvedSkills(resp) {
+    if (resp.skills && resp.skills.length > 0) {
+        return resp.skills.map((s) => ({
+            name: s.name, priority: s.priority, protected: s.protected,
+            category: s.category ?? 'universal',
+        }));
+    }
+    return resp.loaded.map((name, i) => ({
+        name, priority: i, protected: false, category: 'universal',
+    }));
+}
 const cache = new Map();
 const inflightMap = new Map();
 function cacheKey(project, prompt) {
@@ -43,12 +61,45 @@ async function callPortal(project, prompt, role) {
             'Content-Type': 'application/json',
             'Accept': 'application/json',
         };
-        if (SKILLS_TOKEN)
-            headers['Authorization'] = `Bearer ${SKILLS_TOKEN}`;
-        const res = await fetch(`${SYNALUX_BASE}/api/v1/prism/resolve`, {
+        // Auth precedence: static PRISM_SKILLS_TOKEN (legacy/CI) → JWT exchanged
+        // from the synalux API key. The JWT path uses the same per-user identity
+        // as inference, so skills and inference resolve the SAME tier — without
+        // it, machines with only PRISM_SYNALUX_API_KEY silently resolve tier=free
+        // and never receive unprotected/prompt-routed skills.
+        const staticToken = process.env.PRISM_SKILLS_TOKEN || '';
+        let usedJwt = false;
+        if (staticToken) {
+            headers['Authorization'] = `Bearer ${staticToken}`;
+        }
+        else {
+            // Bound the exchange so a hanging JWT endpoint cannot stall
+            // session_load_context startup: after 4s proceed unauthenticated
+            // (free-tier resolve) — the exchange keeps running and its cached
+            // result authenticates the next call.
+            const jwt = await Promise.race([
+                getSynaluxJwt(),
+                new Promise((r) => setTimeout(r, 4_000, null)),
+            ]);
+            if (jwt) {
+                headers['Authorization'] = `Bearer ${jwt}`;
+                usedJwt = true;
+            }
+        }
+        const doFetch = () => fetch(`${SYNALUX_BASE}/api/v1/prism/resolve`, {
             method: 'POST', headers, body: JSON.stringify(body),
             signal: AbortSignal.timeout(5_000),
+            redirect: 'error', // never follow a redirect with a credential attached
         });
+        let res = await doFetch();
+        if (res.status === 401 && usedJwt) {
+            // Expired/rotated JWT — invalidate and retry once with a fresh one.
+            invalidateSynaluxJwt();
+            const fresh = await getSynaluxJwt();
+            if (fresh) {
+                headers['Authorization'] = `Bearer ${fresh}`;
+                res = await doFetch();
+            }
+        }
         if (!res.ok)
             throw new Error(`HTTP ${res.status}`);
         return (await res.json());
@@ -92,9 +143,7 @@ export async function resolveSkills(project, prompt, role) {
     if (cached) {
         return {
             names: cached.resp.loaded,
-            skills: cached.resp.loaded.map((name, i) => ({
-                name, priority: i, protected: false, category: 'universal',
-            })),
+            skills: toResolvedSkills(cached.resp),
             user_local: DEFAULT_UL,
             isOffline: !cached.live,
             routing_version: cached.resp.routing_version,
@@ -107,7 +156,7 @@ export async function resolveSkills(project, prompt, role) {
             if (stored) {
                 const resp = JSON.parse(stored);
                 return {
-                    names: resp.loaded, skills: [], user_local: DEFAULT_UL,
+                    names: resp.loaded, skills: toResolvedSkills(resp), user_local: DEFAULT_UL,
                     isOffline: true,
                     routing_version: resp.routing_version,
                 };

package/dist/utils/inferenceMetrics.js

@@ -12,6 +12,7 @@
  *   undercounts on repeated system-prompt calls; submittedEst shows actual load.
  */
 import { debugLog } from "./logger.js";
+import { appendInferMetric, queryInferMetrics } from "../storage/inferMetricsLedger.js";
 // T1 fix: content-aware token estimator. Replaces flat text.length / 4 which
 // underestimates emoji (~2 UTF-16 units but 1.5-2.5 BPE tokens) and CJK
 // (~1 char ≈ 1 token) by 15-40%, and overestimates dense code (~3.3 chars/token).
@@ -52,6 +53,19 @@ export function recordPromptSeen(delegated) {
 export function recordInference(result) {
     if (result.backend === "safety_gate")
         return;
+    // Durable ledger row (fire-and-forget; in-memory counters below remain the
+    // per-session view). safety_gate is excluded by the early return above.
+    appendInferMetric({
+        backend: result.backend,
+        model: result.model_picked,
+        used_cloud: result.used_cloud,
+        mode: result.mode,
+        gate_outcome: result.quality_gate_failed ? "gate_failed_served" : undefined,
+        prompt_tokens: result.prompt_tokens,
+        completion_tokens: result.completion_tokens,
+        latency_ms: result.latency_ms,
+        ram_free_mb: result.ram_free_mb,
+    });
     const key = result.model_picked ?? result.backend;
     if (result.used_cloud) {
         cloudCalls++;
@@ -135,7 +149,30 @@ export function resetInferenceMetrics() {
     }
     debugLog("[inference-metrics] Session metrics reset");
 }
-export async function inferenceMetricsHandler() {
+export async function inferenceMetricsHandler(args) {
+    if (args?.period === "all") {
+        const agg = await queryInferMetrics();
+        if (!agg || agg.total === 0) {
+            return { content: [{ type: "text", text: "No persisted prism_infer calls yet (ledger empty)." }] };
+        }
+        const localPct = agg.total ? Math.round((agg.local / agg.total) * 100) : 0;
+        const cloudPct = agg.total ? Math.round((agg.cloud / agg.total) * 100) : 0;
+        const span = agg.first_ts && agg.last_ts
+            ? `${new Date(agg.first_ts).toISOString().slice(0, 10)} → ${new Date(agg.last_ts).toISOString().slice(0, 10)}`
+            : "n/a";
+        const byB = Object.entries(agg.by_backend)
+            .sort((a, b) => b[1] - a[1])
+            .map(([k, v]) => `  ${k}: ${v}`).join("\n");
+        return {
+            content: [{
+                    type: "text",
+                    text: `📊 Delegation Metrics — ALL TIME (persisted ledger, ${span})\n` +
+                        `Total calls: ${agg.total} — Local: ${agg.local} (${localPct}%) | Cloud: ${agg.cloud} (${cloudPct}%)\n` +
+                        `Prompt tokens: ${agg.prompt_tokens} | Completion tokens: ${agg.completion_tokens}\n` +
+                        `Avg latency: ${agg.avg_latency_ms}ms\nBy backend:\n${byB}`,
+                }],
+        };
+    }
     const block = formatInferenceMetrics();
     return {
         content: [{

package/dist/utils/skillBudget.js

@@ -0,0 +1,58 @@
+/**
+ * Skill-delivery budgeting — makes the skill block honor the caller's
+ * max_tokens budget instead of inlining every resolved skill.
+ *
+ * Why: paid-tier resolution returns 30+ skills (~114KB measured). Unbudgeted
+ * inlining exceeds host tool-result caps, and hosts divert the WHOLE response
+ * to a file — the agent receives none of it. A budgeted block that fits is
+ * strictly more context than an unbudgeted one that gets diverted.
+ *
+ * Policy (in fill order):
+ *   1. protected skills — ALWAYS inlined in full, even over budget. This is
+ *      the documented floor (2026-06-13 incident: silent truncation stripped
+ *      the agent's core behavioral rules; "protected" exists to prevent that).
+ *   2. prompt-category skills — they matched THIS prompt's keywords; they are
+ *      usually the reason the caller passed `prompt` at all.
+ *   3. everything else (unprotected universal, project, role) by ascending
+ *      priority — while budget remains.
+ * Skills that do not fit are NEVER silently dropped: they are listed in an
+ * overflow manifest so the agent can read them on demand or re-load with a
+ * higher max_tokens.
+ */
+function fillOrder(a, b) {
+    const rank = (e) => e.protected ? 0 : e.category === "prompt" ? 1 : e.category === "role" ? 2 : 3;
+    return rank(a) - rank(b) || a.priority - b.priority;
+}
+function render(e) {
+    const label = e.category === "role" ? "ROLE SKILL" : "SKILL";
+    return `\n\n[📜 ${label}: ${e.name}]\n${e.content.trim()}`;
+}
+/**
+ * Assemble the skill block within `budgetChars`. `budgetChars` ≤ 0 or
+ * non-finite means unbudgeted (legacy behavior: inline everything).
+ */
+export function assembleSkillBlock(entries, budgetChars) {
+    const ordered = [...entries].sort(fillOrder);
+    const unbudgeted = !Number.isFinite(budgetChars) || budgetChars <= 0;
+    let block = "";
+    const inlined = [];
+    const overflow = [];
+    for (const e of ordered) {
+        const piece = render(e);
+        // Protected always inline; others only while they fit.
+        if (unbudgeted || e.protected || block.length + piece.length <= budgetChars) {
+            block += piece;
+            inlined.push(e.name);
+        }
+        else {
+            overflow.push(e.name);
+        }
+    }
+    if (overflow.length > 0) {
+        block +=
+            `\n\n[📦 SKILLS NOT INLINED — max_tokens budget reached]\n` +
+                `${overflow.join(", ")}\n` +
+                `To inline them, re-call session_load_context with a higher max_tokens.`;
+    }
+    return { block, inlined, overflow };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.0.6",
+  "version": "20.0.8",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local-first storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
   "module": "index.ts",